@web-ts-toolkit/access-router 0.32.0 → 0.33.0

package/advanced.mjs

@@ -43,89 +43,982 @@ var FilterOperator = /* @__PURE__ */ ((FilterOperator2) => {
 // src/validation/parsers.ts
 import JsonRouter from "@web-ts-toolkit/express-json-router";
 
-// src/validation/common.ts
+// src/runtime.ts
+import mongoose from "mongoose";
+import mschema2Jsonschema from "mongoose-schema-jsonschema";
+import {
+  addLeadingSlash,
+  forEach as forEach2,
+  get as get2,
+  isArray as isArray4,
+  isBoolean,
+  isFunction,
+  isNil,
+  isPlainObject as isPlainObject7,
+  isString as isString2,
+  keys
+} from "@web-ts-toolkit/utils";
+
+// src/helpers/index.ts
+import { forEach, isArray, isEmpty, isObject, isPlainObject as isPlainObject2, isString, mapValuesAsync } from "@web-ts-toolkit/utils";
+
+// src/lib.ts
+import { Document, Schema } from "mongoose";
+import { isPlainObject } from "@web-ts-toolkit/utils";
+var isSchema = (val) => val instanceof Schema;
+var isObjectIdType = (val) => val === "ObjectId" || val === Schema.Types.ObjectId;
+var isReference = (val) => isPlainObject(val) && !!val.ref && isObjectIdType(val.type);
+
+// src/helpers/index.ts
+function recurseObject(obj) {
+  if (isSchema(obj)) {
+    return buildRefs(obj.tree);
+  }
+  if (!isObject(obj)) return null;
+  if (isReference(obj)) {
+    return obj.ref;
+  }
+  let ret = null;
+  forEach(obj, (val) => {
+    ret = recurseObject(val);
+    if (!isEmpty(ret)) {
+      return false;
+    }
+  });
+  return ret;
+}
+function buildRefs(schema) {
+  if (!isObject(schema)) return {};
+  const references = {};
+  forEach(schema, (val, key) => {
+    const paths = recurseObject(val);
+    if (!isEmpty(paths)) {
+      references[key] = paths;
+    }
+    const target = isObject(val) && "type" in val ? val.type ?? val : val;
+    if (isArray(target) && target.length > 0) {
+      if (isSchema(target[0]) || isPlainObject2(target[0])) {
+        return;
+      }
+    }
+  });
+  return references;
+}
+function buildSubPaths(schema) {
+  if (!isObject(schema)) return [];
+  const subPaths = [];
+  forEach(schema, (val, key) => {
+    const target = isObject(val) && "type" in val ? val.type ?? val : val;
+    if (isArray(target) && target.length > 0) {
+      if (isSchema(target[0]) || isPlainObject2(target[0]) && !isReference(target[0])) {
+        subPaths.push(key);
+      }
+    }
+  });
+  return subPaths;
+}
+
+// src/openapi/build-spec.ts
+import { isArray as isArray2, isPlainObject as isPlainObject4 } from "@web-ts-toolkit/utils";
+
+// src/openapi/responses.ts
+var json = (schema) => ({
+  content: {
+    "application/json": {
+      schema
+    }
+  }
+});
+var problemJson = {
+  content: {
+    "application/problem+json": {
+      schema: {
+        type: "object",
+        properties: {
+          type: { type: "string" },
+          title: { type: "string" },
+          status: { type: "number" },
+          detail: { type: "string" },
+          errors: { type: "array", items: {} }
+        },
+        additionalProperties: true
+      }
+    }
+  }
+};
+var genericDataSchema = { type: "object", additionalProperties: true };
+var genericListSchema = { type: "array", items: genericDataSchema };
+var openApiResponses = {
+  single(description = "Success") {
+    return {
+      200: { description, ...json(genericDataSchema) },
+      400: { description: "Bad Request", ...problemJson },
+      401: { description: "Unauthorized", ...problemJson },
+      404: { description: "Not Found", ...problemJson }
+    };
+  },
+  list(description = "Success") {
+    return {
+      200: { description, ...json(genericListSchema) },
+      400: { description: "Bad Request", ...problemJson },
+      401: { description: "Unauthorized", ...problemJson }
+    };
+  },
+  create(description = "Created") {
+    return {
+      201: { description, ...json(genericDataSchema) },
+      400: { description: "Bad Request", ...problemJson },
+      401: { description: "Unauthorized", ...problemJson }
+    };
+  },
+  delete(description = "Deleted") {
+    return {
+      200: { description, ...json(genericDataSchema) },
+      400: { description: "Bad Request", ...problemJson },
+      401: { description: "Unauthorized", ...problemJson },
+      404: { description: "Not Found", ...problemJson }
+    };
+  },
+  batch(description = "Success") {
+    return {
+      200: { description, ...json(genericListSchema) },
+      400: { description: "Bad Request", ...problemJson },
+      401: { description: "Unauthorized", ...problemJson }
+    };
+  }
+};
+
+// src/openapi/schemas.ts
 import { z } from "zod";
-var stringOrStringArray = z.union([z.string(), z.array(z.string())]);
-var queryBooleanString = z.enum(["true", "false"]);
-var positiveIntegerString = z.string().regex(/^\d+$/, "Expected a non-negative integer");
-var nonNegativeIntegerSchema = z.number().int().min(0);
-var unknownRecord = z.record(z.string(), z.unknown());
-var projectionObjectSchema = z.record(z.string(), z.union([z.literal(1), z.literal(-1)]));
-var projectionSchema = z.union([z.string(), z.array(z.string()), projectionObjectSchema]);
-var sortOrderSchema = z.union([
-  z.literal(-1),
-  z.literal(1),
-  z.literal("asc"),
-  z.literal("ascending"),
-  z.literal("desc"),
-  z.literal("descending")
+import { isPlainObject as isPlainObject3 } from "@web-ts-toolkit/utils";
+var fallbackObjectSchema = { type: "object", additionalProperties: true };
+function isOpenApiSchemaPatch(source) {
+  return isPlainObject3(source) && source.kind === "objectProperties";
+}
+function isOpenApiSchemaResolver(source) {
+  return isPlainObject3(source) && source.kind === "schemaResolver" && typeof source.resolve === "function";
+}
+function isJsonSchemaLike(source) {
+  return isPlainObject3(source) && ("type" in source || "properties" in source || "$ref" in source || "anyOf" in source);
+}
+function hasOpenApiSchema(source) {
+  return isPlainObject3(source) && isJsonSchemaLike(source.openapi);
+}
+function toOpenApiSchema(source) {
+  if (!source) return void 0;
+  const resolvedSource = isOpenApiSchemaResolver(source) ? source.resolve() : source;
+  if (!resolvedSource) return void 0;
+  if (isOpenApiSchemaPatch(resolvedSource)) {
+    const schema = toOpenApiSchema(resolvedSource.source) ?? { ...fallbackObjectSchema };
+    const properties = isPlainObject3(schema.properties) ? { ...schema.properties } : {};
+    for (const [key, value] of Object.entries(resolvedSource.properties)) {
+      properties[key] = toOpenApiSchema(value) ?? fallbackObjectSchema;
+    }
+    return {
+      ...schema,
+      type: schema.type ?? "object",
+      properties
+    };
+  }
+  if (hasOpenApiSchema(resolvedSource)) {
+    return resolvedSource.openapi;
+  }
+  if (isJsonSchemaLike(resolvedSource)) {
+    return resolvedSource;
+  }
+  try {
+    return z.toJSONSchema(resolvedSource);
+  } catch {
+    return fallbackObjectSchema;
+  }
+}
+
+// src/openapi/build-spec.ts
+var openApiMediaType = "application/json";
+var normalizePath = (path) => {
+  if (!path) return "/";
+  return path.startsWith("/") ? path : `/${path}`;
+};
+var toOpenApiPath = (path) => normalizePath(path).replace(/:([A-Za-z0-9_]+)/g, "{$1}");
+var schemaToQueryParameters = (schema) => {
+  const jsonSchema = toOpenApiSchema(schema);
+  if (!jsonSchema || jsonSchema.type !== "object") return [];
+  const properties = isPlainObject4(jsonSchema.properties) ? jsonSchema.properties : {};
+  const required = new Set(
+    isArray2(jsonSchema.required) ? jsonSchema.required.filter((item) => typeof item === "string") : []
+  );
+  return Object.entries(properties).map(([name, value]) => ({
+    name,
+    in: "query",
+    required: required.has(name),
+    schema: value
+  }));
+};
+var schemaToPathParameters = (path, pathParams) => {
+  const names = [...toOpenApiPath(path).matchAll(/\{([^}]+)\}/g)].map((item) => item[1]);
+  return names.map((name) => ({
+    name,
+    in: "path",
+    required: true,
+    schema: (pathParams && name in pathParams ? toOpenApiSchema(pathParams[name]) : void 0) ?? { type: "string" }
+  }));
+};
+var getDefaultResponses = (route) => {
+  if (route.operationId === "root.query") return openApiResponses.batch();
+  if (route.method === "delete") return openApiResponses.delete();
+  if (route.operationId?.toLowerCase().includes("create")) return openApiResponses.create();
+  if (route.operationId?.toLowerCase().includes("list")) return openApiResponses.list();
+  if (route.operationId?.toLowerCase().includes("distinct")) return openApiResponses.list();
+  return openApiResponses.single();
+};
+var buildOperation = (route) => {
+  const queryParameters = schemaToQueryParameters(route.query);
+  const pathParameters = schemaToPathParameters(route.path, route.pathParams);
+  const bodySchema = toOpenApiSchema(route.body);
+  const responses = route.responses ?? getDefaultResponses(route);
+  const operation = {
+    operationId: route.operationId,
+    summary: route.summary,
+    description: route.description,
+    tags: route.tags,
+    deprecated: route.deprecated,
+    responses
+  };
+  const parameters = [...pathParameters, ...queryParameters];
+  if (parameters.length) {
+    operation.parameters = parameters;
+  }
+  if (bodySchema) {
+    operation.requestBody = {
+      required: true,
+      content: {
+        [openApiMediaType]: {
+          schema: bodySchema
+        }
+      }
+    };
+  }
+  if (route.acl) {
+    operation["x-access-router-acl"] = route.acl;
+  }
+  return operation;
+};
+function buildOpenApiSpec(routes, options) {
+  const paths = {};
+  const { servers, ...info } = options;
+  for (const route of routes) {
+    const path = toOpenApiPath(route.path);
+    if (!paths[path]) {
+      paths[path] = {};
+    }
+    paths[path][route.method] = buildOperation(route);
+  }
+  return {
+    openapi: "3.1.0",
+    info,
+    servers,
+    paths
+  };
+}
+
+// src/openapi/errors.ts
+var OpenApiCollisionError = class extends Error {
+  constructor(message, details) {
+    super(message);
+    this.name = "OpenApiCollisionError";
+    this.collisionKind = details.collisionKind;
+    this.method = details.method;
+    this.path = details.path;
+    this.operationId = details.operationId;
+    this.existing = details.existing;
+    this.incoming = details.incoming;
+  }
+};
+
+// src/openapi/registry.ts
+var isPlainObject5 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var stableKey = (value) => {
+  if (value === null || typeof value === "undefined") return "null";
+  if (typeof value === "function") return "[Function]";
+  if (typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) {
+    return `[${value.map(stableKey).join(",")}]`;
+  }
+  const obj = value;
+  return `{${Object.keys(obj).sort().map((k) => `${JSON.stringify(k)}:${stableKey(obj[k])}`).join(",")}}`;
+};
+var descriptorsEqual = (a, b) => {
+  return a.method === b.method && a.path === b.path && (a.operationId ?? "") === (b.operationId ?? "") && (a.acl ?? "") === (b.acl ?? "") && stableKey(a.query) === stableKey(b.query) && stableKey(a.body) === stableKey(b.body) && stableKey(a.pathParams) === stableKey(b.pathParams) && stableKey(a.responses) === stableKey(b.responses) && stableKey(a.tags) === stableKey(b.tags) && (a.summary ?? "") === (b.summary ?? "") && (a.description ?? "") === (b.description ?? "") && Boolean(a.deprecated) === Boolean(b.deprecated);
+};
+var OpenApiRegistry = class {
+  constructor(options = {}) {
+    this.routes = [];
+    this.options = {
+      rejectConflicts: options.rejectConflicts ?? true,
+      rejectDuplicateOperationIds: options.rejectDuplicateOperationIds ?? true
+    };
+  }
+  register(route) {
+    const existingIndex = this.routes.findIndex((item) => item.method === route.method && item.path === route.path);
+    if (existingIndex === -1) {
+      this.assertOperationIdAvailable(route);
+      this.routes.push(route);
+      return;
+    }
+    const existing = this.routes[existingIndex];
+    if (route.allowReplace) {
+      this.assertOperationIdAvailable(route, existing);
+      this.routes[existingIndex] = route;
+      return;
+    }
+    if (descriptorsEqual(existing, route) && (route.idempotent || isPlainObject5(existing) && existing.idempotent)) {
+      return;
+    }
+    if (this.options.rejectConflicts) {
+      throw new OpenApiCollisionError(
+        `OpenAPI route collision: ${route.method.toUpperCase()} ${route.path} is already registered` + (existing.operationId ? ` as operationId="${existing.operationId}"` : "") + (route.operationId ? `; new registration uses operationId="${route.operationId}"` : "") + ". Set allowReplace:true on the new descriptor to override, or fix the duplicate registration.",
+        {
+          collisionKind: "path",
+          method: route.method,
+          path: route.path,
+          existing,
+          incoming: route
+        }
+      );
+    }
+    this.routes[existingIndex] = route;
+  }
+  assertOperationIdAvailable(route, replacing) {
+    if (!this.options.rejectDuplicateOperationIds) return;
+    if (!route.operationId) return;
+    const clash = this.routes.find(
+      (item) => item.operationId && item.operationId === route.operationId && item !== replacing
+    );
+    if (clash) {
+      if (route.idempotent && clash.idempotent) return;
+      throw new OpenApiCollisionError(
+        `OpenAPI operationId collision: "${route.operationId}" is already bound to ${clash.method.toUpperCase()} ${clash.path}. Each operationId must be unique across the spec.`,
+        {
+          collisionKind: "operationId",
+          operationId: route.operationId,
+          existing: clash,
+          incoming: route
+        }
+      );
+    }
+  }
+  getRoutes() {
+    return [...this.routes];
+  }
+  clear() {
+    this.routes.length = 0;
+  }
+  setStrictMode(enabled) {
+    this.options.rejectConflicts = enabled;
+    this.options.rejectDuplicateOperationIds = enabled;
+  }
+  getSpec(info) {
+    return buildOpenApiSpec(this.routes, info);
+  }
+};
+
+// src/logger-default.ts
+import util from "util";
+import { createLogger, format, transports } from "winston";
+var colorizer = format.colorize();
+var defaultLogLevel = process.env.WTT_LOG_LEVEL || "silent";
+var inspectValue = (value) => {
+  return typeof value === "string" ? value : util.inspect(value, { depth: 5, colors: false });
+};
+var defaultLogger = createLogger({
+  level: defaultLogLevel,
+  format: format.combine(
+    format.errors({ stack: true }),
+    format.splat(),
+    format.label({ label: "[WTT]" }),
+    format.timestamp(),
+    format.printf(({ level, label, message, timestamp, stack, ...meta }) => {
+      const formattedLabel = colorizer.colorize(level, String(label));
+      const formattedLevel = colorizer.colorize(level, `[${String(level).toUpperCase()}]`);
+      const formattedMessage = colorizer.colorize(level, inspectValue(stack ?? message));
+      const formattedMeta = Object.keys(meta).length > 0 ? ` ${inspectValue(meta)}` : "";
+      return `${formattedLabel} ${timestamp} ${formattedLevel} ${formattedMessage}${formattedMeta}`;
+    })
+  ),
+  transports: [new transports.Console()]
+});
+
+// src/options/manager.ts
+import { assign, get, set } from "@web-ts-toolkit/utils";
+var getNestedOption = (manager, key, defaultValue) => {
+  const keys2 = String(key).split(".");
+  if (keys2.length === 1) {
+    return manager.get(key, defaultValue);
+  }
+  let option = manager.get(key, void 0);
+  if (option !== void 0) {
+    return option;
+  }
+  const parentKey = keys2.slice(0, -1).join(".");
+  option = manager.get(`${parentKey}.default`, void 0);
+  if (option === void 0) {
+    option = manager.get(parentKey, defaultValue);
+  }
+  return option;
+};
+var OptionsManager = class {
+  constructor(defaultOptions) {
+    this.defaultOptions = defaultOptions;
+    this.listeners = {};
+    const _this = this;
+    this.currentOptions = new Proxy({}, {
+      set(target, key, value) {
+        const keystr = String(key);
+        const oldvalue = target[keystr];
+        target[keystr] = value;
+        _this.listeners[keystr] && _this.listeners[keystr].call(_this, value, keystr, target, oldvalue);
+        return true;
+      }
+    });
+  }
+  build() {
+    this.assign(this.defaultOptions);
+    return this;
+  }
+  get(key, defaultValue) {
+    return get(this.currentOptions, key, defaultValue);
+  }
+  set(key, value) {
+    set(this.currentOptions, key, value);
+  }
+  fetch() {
+    return { ...this.currentOptions };
+  }
+  assign(options) {
+    assign(this.currentOptions, options);
+  }
+  onchange(key, func) {
+    set(this.listeners, key, func);
+    return this;
+  }
+};
+
+// src/request-complexity.ts
+import { isArray as isArray3, isPlainObject as isPlainObject6 } from "@web-ts-toolkit/utils";
+var defaultRequestComplexity = {
+  maxDepth: 8,
+  maxNodes: 500,
+  maxLogicalClauses: 50,
+  maxInValues: 100,
+  maxBulkItems: 100,
+  maxIncludeCount: 10,
+  maxSubQueryCount: 10,
+  maxBulkConcurrency: 10
+};
+var normalizePositiveInteger = (value, fallback) => {
+  return Number.isSafeInteger(value) && Number(value) > 0 ? Number(value) : fallback;
+};
+var resolveRequestComplexity = (options) => ({
+  maxDepth: normalizePositiveInteger(options?.maxDepth, defaultRequestComplexity.maxDepth),
+  maxNodes: normalizePositiveInteger(options?.maxNodes, defaultRequestComplexity.maxNodes),
+  maxLogicalClauses: normalizePositiveInteger(options?.maxLogicalClauses, defaultRequestComplexity.maxLogicalClauses),
+  maxInValues: normalizePositiveInteger(options?.maxInValues, defaultRequestComplexity.maxInValues),
+  maxBulkItems: normalizePositiveInteger(options?.maxBulkItems, defaultRequestComplexity.maxBulkItems),
+  maxIncludeCount: normalizePositiveInteger(options?.maxIncludeCount, defaultRequestComplexity.maxIncludeCount),
+  maxSubQueryCount: normalizePositiveInteger(options?.maxSubQueryCount, defaultRequestComplexity.maxSubQueryCount),
+  maxBulkConcurrency: normalizePositiveInteger(
+    options?.maxBulkConcurrency,
+    defaultRequestComplexity.maxBulkConcurrency
+  )
+});
+function validateRequestComplexity(value, options, scope = "request") {
+  const limits = resolveRequestComplexity(options);
+  const errors = [];
+  let nodes = 0;
+  let logicalClauses = 0;
+  let includeCount = 0;
+  let subQueryCount = 0;
+  const pointer = (path) => path.length === 0 ? "#" : `#/${path.join("/")}`;
+  const pushError = (detail, path) => {
+    if (errors.length === 0) {
+      errors.push({ detail, pointer: pointer(path) });
+    }
+  };
+  const visit = (current, path, depth, parentKey) => {
+    if (errors.length > 0) return;
+    nodes += 1;
+    if (nodes > limits.maxNodes) {
+      pushError(`Request exceeds maximum node budget of ${limits.maxNodes}`, path);
+      return;
+    }
+    if (depth > limits.maxDepth) {
+      pushError(`Request exceeds maximum depth of ${limits.maxDepth}`, path);
+      return;
+    }
+    if (isArray3(current)) {
+      if (parentKey === "$and" || parentKey === "$or" || parentKey === "$nor") {
+        logicalClauses += current.length;
+        if (logicalClauses > limits.maxLogicalClauses) {
+          pushError(`Filter exceeds maximum logical clause budget of ${limits.maxLogicalClauses}`, path);
+          return;
+        }
+      }
+      if (parentKey === "$in") {
+        if (current.length > limits.maxInValues) {
+          pushError(`Filter exceeds maximum $in values of ${limits.maxInValues}`, path);
+          return;
+        }
+      }
+      for (let index = 0; index < current.length; index++) {
+        visit(current[index], path.concat(index), depth + 1, parentKey);
+        if (errors.length > 0) return;
+      }
+      return;
+    }
+    if (!isPlainObject6(current)) return;
+    for (const [key, child] of Object.entries(current)) {
+      if (key === "__proto__" || key === "prototype" || key === "constructor") {
+        pushError(`Unsupported key: ${key}`, path.concat(key));
+        return;
+      }
+      if (scope === "request" && key === "include") {
+        includeCount += isArray3(child) ? child.length : 1;
+        if (includeCount > limits.maxIncludeCount) {
+          pushError(`Request exceeds maximum include count of ${limits.maxIncludeCount}`, path.concat(key));
+          return;
+        }
+      }
+      if (key === "$$sq") {
+        subQueryCount += 1;
+        if (subQueryCount > limits.maxSubQueryCount) {
+          pushError(`Request exceeds maximum subquery count of ${limits.maxSubQueryCount}`, path.concat(key));
+          return;
+        }
+        visit(child, path.concat(key), depth + 1, key);
+        if (errors.length > 0) return;
+        continue;
+      }
+      visit(child, path.concat(key), depth + 1, key);
+      if (errors.length > 0) return;
+    }
+  };
+  visit(value, [], 0);
+  return errors;
+}
+
+// src/runtime.ts
+var mongooseJsonSchemaInitialized = false;
+var ensureMongooseJsonSchemaInitialized = () => {
+  if (mongooseJsonSchemaInitialized) return;
+  mschema2Jsonschema(mongoose);
+  mongooseJsonSchemaInitialized = true;
+};
+var pluralize = mongoose.pluralize();
+var FIELD_ACCESS_KEYS = ["list", "create", "read", "update"];
+var defaultModelOptions = {
+  basePath: null,
+  alwaysSelectFields: []
+};
+var defaultDataOptions = {
+  basePath: null,
+  parentPath: "/",
+  queryRouteSegment: "__query"
+};
+var normalizeBasePath = (name, value) => {
+  if (isNil(value)) {
+    return `/${pluralize(name)}`;
+  }
+  return isString2(value) ? addLeadingSlash(value) : "";
+};
+var hasModelPermission = (value, modelPermissionPrefix) => {
+  if (!modelPermissionPrefix) {
+    return true;
+  }
+  if (isString2(value)) {
+    return value.trim().split(" ").some((item) => item.startsWith(modelPermissionPrefix));
+  }
+  if (isArray4(value)) {
+    return value.some((item) => {
+      if (isString2(item) || isArray4(item)) {
+        return hasModelPermission(item, modelPermissionPrefix);
+      }
+      return true;
+    });
+  }
+  return isFunction(value);
+};
+var classifyPermissionSchema = (permissionSchema, modelPermissionPrefix) => {
+  const schemaKeys = Object.keys(permissionSchema);
+  const globalPermissionKeys = {};
+  const modelPermissionKeys = {};
+  forEach2(schemaKeys, (schemaKey) => {
+    const schemaRule = permissionSchema[schemaKey];
+    const ruleEntries = isPlainObject7(schemaRule) ? Object.entries(schemaRule) : FIELD_ACCESS_KEYS.map((accessKey) => [accessKey, schemaRule]);
+    for (let x = 0; x < ruleEntries.length; x++) {
+      const [accessKey, value] = ruleEntries[x];
+      if (!isArray4(globalPermissionKeys[accessKey])) {
+        globalPermissionKeys[accessKey] = [];
+      }
+      if (!isArray4(modelPermissionKeys[accessKey])) {
+        modelPermissionKeys[accessKey] = [];
+      }
+      if (isBoolean(value)) {
+        globalPermissionKeys[accessKey].push(schemaKey);
+        return;
+      }
+      if (hasModelPermission(value, modelPermissionPrefix)) {
+        modelPermissionKeys[accessKey].push(schemaKey);
+        return;
+      }
+      globalPermissionKeys[accessKey].push(schemaKey);
+    }
+  });
+  return {
+    schemaKeys,
+    globalPermissionKeys,
+    modelPermissionKeys
+  };
+};
+var AccessRuntime = class {
+  constructor() {
+    this.globalOptions = new OptionsManager({
+      requestPermissionField: "_permissions",
+      globalPermissions: () => ({}),
+      logger: defaultLogger,
+      requestComplexity: defaultRequestComplexity
+    }).build();
+    this.defaultModelOptions = new OptionsManager({
+      listHardLimit: 1e3,
+      documentPermissionField: "_permissions",
+      idParam: "id",
+      idField: "_id",
+      parentPath: "/",
+      queryRouteSegment: "__query",
+      mutationRouteSegment: "__mutation",
+      operationAccess: false,
+      modelPermissionPrefix: ""
+    }).build();
+    this.modelOptions = {};
+    this.modelJsonSchemas = {};
+    this.dataOptions = {};
+    this.modelRefs = {};
+    this.modelSubs = {};
+    this.modelAtts = {};
+    this.modelInstances = {};
+    this.openApiRegistry = new OpenApiRegistry();
+    ensureMongooseJsonSchemaInitialized();
+  }
+  registerModelInstance(modelName, model) {
+    if (!modelName || typeof modelName !== "string") {
+      throw new TypeError(`registerModelInstance: modelName must be a non-empty string, received ${typeof modelName}`);
+    }
+    const existing = this.modelInstances[modelName];
+    if (existing && existing !== model) {
+      throw new Error(
+        `Runtime model registry conflict: model "${modelName}" is already registered to a different mongoose.Model instance on this runtime. Use a distinct model name or a separate runtime.`
+      );
+    }
+    this.modelInstances[modelName] = model;
+  }
+  hasModelInstance(modelName) {
+    return modelName in this.modelInstances;
+  }
+  getModelInstance(modelName) {
+    const registered = this.modelInstances[modelName];
+    if (registered) return registered;
+    const global = mongoose.models[modelName];
+    return global ?? null;
+  }
+  registerOpenApiRoute(route) {
+    this.openApiRegistry.register(route);
+  }
+  /**
+   * Enable strict OpenAPI collision detection for the remainder of this
+   * runtime's lifetime. After this call, conflicting method/path
+   * registrations and duplicate operationIds throw {@link OpenApiCollisionError}
+   * instead of silently replacing. Existing already-registered routes are
+   * not retroactively re-validated.
+   */
+  enableOpenApiCollisionDetection() {
+    this.openApiRegistry.setStrictMode(true);
+  }
+  getOpenApiRoutes() {
+    return this.openApiRegistry.getRoutes();
+  }
+  clearOpenApiRoutes() {
+    this.openApiRegistry.clear();
+  }
+  getOpenApiSpec(info) {
+    return this.openApiRegistry.getSpec(info);
+  }
+  setGlobalOptions(options) {
+    this.globalOptions.assign(options);
+  }
+  setGlobalOption(key, value) {
+    this.globalOptions.set(key, value);
+  }
+  getGlobalOptions() {
+    return this.globalOptions.fetch();
+  }
+  getGlobalOption(key, defaultValue) {
+    return this.globalOptions.get(key, defaultValue);
+  }
+  setDefaultModelOptions(options) {
+    this.defaultModelOptions.assign(options);
+  }
+  setDefaultModelOption(key, value) {
+    this.defaultModelOptions.set(key, value);
+  }
+  getDefaultModelOptions() {
+    return this.defaultModelOptions.fetch();
+  }
+  getDefaultModelOption(key, defaultValue) {
+    return this.defaultModelOptions.get(key, defaultValue);
+  }
+  createModelOptions(modelName) {
+    const model = this.getModelInstance(modelName) ?? mongoose.model(modelName);
+    const manager = new OptionsManager({
+      ...defaultModelOptions,
+      modelName
+    });
+    manager.onchange("permissionSchema", function(newval, key, target) {
+      const permissionSchema = newval ?? {};
+      const { schemaKeys, globalPermissionKeys, modelPermissionKeys } = classifyPermissionSchema(
+        permissionSchema,
+        target.modelPermissionPrefix ?? ""
+      );
+      target._permissionSchemaKeys = schemaKeys;
+      target._globalPermissionKeys = globalPermissionKeys;
+      target._modelPermissionKeys = modelPermissionKeys;
+    }).onchange("basePath", function(newval, key, target) {
+      target[key] = normalizeBasePath(
+        modelName,
+        isString2(newval) || isNil(newval) ? newval : void 0
+      );
+    }).build();
+    this.modelJsonSchemas[modelName] = model.jsonSchema();
+    return manager;
+  }
+  getOrCreateModelOptions(modelName) {
+    let manager = this.modelOptions[modelName];
+    if (!manager) {
+      manager = this.createModelOptions(modelName);
+      this.modelOptions[modelName] = manager;
+    }
+    return manager;
+  }
+  setModelOptions(modelName, options) {
+    const manager = this.getOrCreateModelOptions(modelName);
+    const defaultOptions = this.getDefaultModelOptions();
+    const currentModelOptions = manager.fetch();
+    manager.assign({ ...defaultOptions, ...currentModelOptions, ...options });
+  }
+  setModelOption(modelName, key, value) {
+    const manager = this.getOrCreateModelOptions(modelName);
+    manager.set(key, value);
+  }
+  getModelOptions(modelName) {
+    const manager = this.getOrCreateModelOptions(modelName);
+    return manager.fetch();
+  }
+  getModelOption(modelName, key, defaultValue) {
+    const manager = this.getOrCreateModelOptions(modelName);
+    const defaultModelValue = this.getDefaultModelOption(
+      key,
+      defaultValue
+    );
+    return getNestedOption(manager, key, defaultModelValue);
+  }
+  getExactModelOption(modelName, key) {
+    const manager = this.getOrCreateModelOptions(modelName);
+    const defaultModelValue = this.getDefaultModelOption(key);
+    return manager.get(key, defaultModelValue);
+  }
+  getModelNames() {
+    return Object.keys(this.modelOptions);
+  }
+  hasModel(modelName) {
+    return modelName in this.modelOptions;
+  }
+  getModelJsonSchema(modelName) {
+    return this.modelJsonSchemas[modelName];
+  }
+  createDataOptions(dataName) {
+    const manager = new OptionsManager({
+      ...defaultDataOptions,
+      dataName
+    });
+    manager.onchange("basePath", function(newval, key, target) {
+      target[key] = normalizeBasePath(
+        dataName,
+        isString2(newval) || isNil(newval) ? newval : void 0
+      );
+    }).build();
+    return manager;
+  }
+  getOrCreateDataOptions(dataName) {
+    let manager = this.dataOptions[dataName];
+    if (!manager) {
+      manager = this.createDataOptions(dataName);
+      this.dataOptions[dataName] = manager;
+    }
+    return manager;
+  }
+  setDataOptions(dataName, options) {
+    const manager = this.getOrCreateDataOptions(dataName);
+    const currentDataOptions = manager.fetch();
+    manager.assign({ ...currentDataOptions, ...options });
+  }
+  setDataOption(dataName, key, value) {
+    const manager = this.getOrCreateDataOptions(dataName);
+    manager.set(key, value);
+  }
+  getDataOptions(dataName) {
+    const manager = this.getOrCreateDataOptions(dataName);
+    return manager.fetch();
+  }
+  getDataOption(dataName, key, defaultValue) {
+    const manager = this.getOrCreateDataOptions(dataName);
+    return getNestedOption(manager, key, defaultValue);
+  }
+  getExactDataOption(dataName, key) {
+    const manager = this.getOrCreateDataOptions(dataName);
+    return manager.get(key);
+  }
+  getDataNames() {
+    return Object.keys(this.dataOptions);
+  }
+  ensureModelMeta(modelName) {
+    if (modelName in this.modelRefs && modelName in this.modelSubs && modelName in this.modelAtts) {
+      return;
+    }
+    const model = this.getModelInstance(modelName);
+    if (!model) {
+      this.modelRefs[modelName] = this.modelRefs[modelName] ?? {};
+      this.modelSubs[modelName] = this.modelSubs[modelName] ?? [];
+      this.modelAtts[modelName] = this.modelAtts[modelName] ?? [];
+      return;
+    }
+    const schema = model.schema;
+    this.modelRefs[modelName] = buildRefs(schema.tree);
+    this.modelSubs[modelName] = buildSubPaths(schema.tree);
+    this.modelAtts[modelName] = keys(schema.obj);
+  }
+  getModelRef(modelName, refPath) {
+    this.ensureModelMeta(modelName);
+    const value = get2(this.modelRefs, `${modelName}.${refPath}`, null);
+    return isString2(value) ? value : null;
+  }
+  getModelSub(modelName) {
+    this.ensureModelMeta(modelName);
+    return get2(this.modelSubs, modelName, []);
+  }
+  getModelAtt(modelName) {
+    this.ensureModelMeta(modelName);
+    return get2(this.modelAtts, modelName, []);
+  }
+};
+var defaultRuntime = new AccessRuntime();
+
+// src/runtime-context.ts
+import { AsyncLocalStorage } from "async_hooks";
+var runtimeStorage = new AsyncLocalStorage();
+function getActiveRuntime() {
+  return runtimeStorage.getStore() ?? null;
+}
+
+// src/options/global-options.ts
+var getRuntime = () => getActiveRuntime() ?? defaultRuntime;
+var getGlobalOption = (key, defaultValue) => {
+  return getRuntime().getGlobalOption(key, defaultValue);
+};
+
+// src/validation/common.ts
+import { z as z2 } from "zod";
+var stringOrStringArray = z2.union([z2.string(), z2.array(z2.string())]);
+var safeIntegerString = (min, message) => z2.string().regex(/^\d+$/, message).refine((value) => Number.isSafeInteger(Number(value)), "Expected a safe integer").refine((value) => Number(value) >= min, message);
+var queryBooleanString = z2.enum(["true", "false"]);
+var nonNegativeIntegerString = safeIntegerString(0, "Expected a non-negative integer");
+var positiveIntegerString = safeIntegerString(1, "Expected a positive integer");
+var nonNegativeIntegerSchema = z2.number().int().min(0).max(Number.MAX_SAFE_INTEGER);
+var positiveIntegerSchema = z2.number().int().min(1).max(Number.MAX_SAFE_INTEGER);
+var unknownRecord = z2.record(z2.string(), z2.unknown());
+var projectionObjectSchema = z2.record(z2.string(), z2.union([z2.literal(1), z2.literal(-1)]));
+var projectionSchema = z2.union([z2.string(), z2.array(z2.string()), projectionObjectSchema]);
+var sortOrderSchema = z2.union([
+  z2.literal(-1),
+  z2.literal(1),
+  z2.literal("asc"),
+  z2.literal("ascending"),
+  z2.literal("desc"),
+  z2.literal("descending")
 ]);
-var sortSchema = z.union([
-  z.string(),
-  z.record(z.string(), sortOrderSchema),
-  z.array(z.tuple([z.string(), sortOrderSchema])),
-  z.null()
+var sortSchema = z2.union([
+  z2.string(),
+  z2.record(z2.string(), sortOrderSchema),
+  z2.array(z2.tuple([z2.string(), sortOrderSchema])),
+  z2.null()
 ]);
-var populateSchema = z.union([
-  z.string(),
-  z.array(
-    z.union([
-      z.string(),
-      z.object({
-        path: z.string().min(1),
+var populateSchema = z2.union([
+  z2.string(),
+  z2.array(
+    z2.union([
+      z2.string(),
+      z2.object({
+        path: z2.string().min(1),
         select: projectionSchema.optional(),
-        match: z.unknown().optional(),
-        access: z.enum(["list", "read"]).optional()
+        match: z2.unknown().optional(),
+        access: z2.enum(["list", "read"]).optional()
       }).passthrough()
     ])
   ),
-  z.object({
-    path: z.string().min(1),
+  z2.object({
+    path: z2.string().min(1),
     select: projectionSchema.optional(),
-    match: z.unknown().optional(),
-    access: z.enum(["list", "read"]).optional()
+    match: z2.unknown().optional(),
+    access: z2.enum(["list", "read"]).optional()
   }).passthrough()
 ]);
-var subPopulateSchema = z.union([
-  z.string(),
-  z.array(
-    z.union([
-      z.string(),
-      z.object({
-        path: z.string().min(1),
+var subPopulateSchema = z2.union([
+  z2.string(),
+  z2.array(
+    z2.union([
+      z2.string(),
+      z2.object({
+        path: z2.string().min(1),
         select: projectionSchema.optional()
       }).passthrough()
     ])
   ),
-  z.object({
-    path: z.string().min(1),
+  z2.object({
+    path: z2.string().min(1),
     select: projectionSchema.optional()
   }).passthrough()
 ]);
-var includeItemSchema = z.object({
-  model: z.string().min(1),
-  op: z.enum(["list", "read", "count"]),
-  path: z.string().min(1),
-  filter: z.record(z.string(), z.unknown()).optional(),
-  localField: z.string().min(1),
-  foreignField: z.string().min(1),
-  args: z.unknown().optional(),
-  options: z.unknown().optional()
+var includeItemSchema = z2.object({
+  model: z2.string().min(1),
+  op: z2.enum(["list", "read", "count"]),
+  path: z2.string().min(1),
+  filter: z2.record(z2.string(), z2.unknown()).optional(),
+  localField: z2.string().min(1),
+  foreignField: z2.string().min(1),
+  args: z2.unknown().optional(),
+  options: z2.unknown().optional()
 }).passthrough();
-var includeSchema = z.union([includeItemSchema, z.array(includeItemSchema)]);
-var fieldsSchema = z.array(z.string().min(1));
-var taskSchema = z.object({
-  type: z.string().min(1),
-  args: z.unknown(),
+var includeSchema = z2.union([includeItemSchema, z2.array(includeItemSchema)]);
+var fieldsSchema = z2.array(z2.string().min(1));
+var taskSchema = z2.object({
+  type: z2.string().min(1),
+  args: z2.unknown(),
   options: unknownRecord.optional()
 });
-var tasksSchema = z.union([taskSchema, z.array(taskSchema)]);
-var objectOrArraySchema = z.union([z.record(z.string(), z.unknown()), z.array(z.unknown())]);
-function rejectKeys(body, ctx, keys) {
-  for (const key of keys) {
+var tasksSchema = z2.union([taskSchema, z2.array(taskSchema)]);
+var objectOrArraySchema = z2.union([z2.record(z2.string(), z2.unknown()), z2.array(z2.unknown())]);
+function rejectKeys(body, ctx, keys2) {
+  for (const key of keys2) {
     if (key in body) {
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: z2.ZodIssueCode.custom,
         message: `Unsupported field: ${key}`,
         path: [key]
       });
@@ -149,6 +1042,10 @@ function parsePathParam(value, parameter) {
   return param;
 }
 function parseQuery(schema, value) {
+  const complexityErrors = validateRequestComplexity(value, getGlobalOption("requestComplexity"), "request");
+  if (complexityErrors.length > 0) {
+    throw new clientErrors.BadRequestError("Bad Request", { errors: complexityErrors });
+  }
   const result = schema.safeParse(value);
   if (!result.success) {
     throwValidationError(normalizeIssues(result.error.issues), void 0, "parameter");
@@ -156,6 +1053,10 @@ function parseQuery(schema, value) {
   return result.data;
 }
 function parseBody(schema, value) {
+  const complexityErrors = validateRequestComplexity(value ?? {}, getGlobalOption("requestComplexity"), "request");
+  if (complexityErrors.length > 0) {
+    throw new clientErrors.BadRequestError("Bad Request", { errors: complexityErrors });
+  }
   const result = schema.safeParse(value ?? {});
   if (!result.success) {
     throwValidationError(normalizeIssues(result.error.issues), void 0, "pointer");
@@ -498,133 +1399,130 @@ function buildPointer(path) {
 }
 
 // src/validation/model-router.ts
-import { z as z2 } from "zod";
-var listQuerySchema = z2.object({
-  skip: positiveIntegerString.optional(),
+import { z as z3 } from "zod";
+var listQuerySchema = z3.object({
+  skip: nonNegativeIntegerString.optional(),
   limit: positiveIntegerString.optional(),
-  page: positiveIntegerString.optional(),
+  page: nonNegativeIntegerString.optional(),
   page_size: positiveIntegerString.optional(),
   skim: queryBooleanString.optional(),
   include_permissions: queryBooleanString.optional(),
   include_count: queryBooleanString.optional(),
   include_extra_headers: queryBooleanString.optional()
 }).passthrough();
-var createQuerySchema = z2.object({
+var createQuerySchema = z3.object({
   include_permissions: queryBooleanString.optional()
 }).passthrough();
-var readQuerySchema = z2.object({
+var readQuerySchema = z3.object({
   include_permissions: queryBooleanString.optional(),
   try_list: queryBooleanString.optional()
 }).passthrough();
-var updateQuerySchema = z2.object({
+var updateQuerySchema = z3.object({
   returning_all: queryBooleanString.optional(),
   include_permissions: queryBooleanString.optional()
 }).passthrough();
-var upsertQuerySchema = z2.object({
+var upsertQuerySchema = z3.object({
   returning_all: queryBooleanString.optional(),
   include_permissions: queryBooleanString.optional()
 }).passthrough();
-var listBodySchema = z2.object({
+var listBodySchema = z3.object({
   filter: objectOrArraySchema.optional(),
   select: projectionSchema.optional(),
   sort: sortSchema.optional(),
   populate: populateSchema.optional(),
   include: includeSchema.optional(),
   tasks: tasksSchema.optional(),
-  skip: z2.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  limit: z2.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  page: z2.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  pageSize: z2.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  options: z2.object({
-    skim: z2.boolean().optional(),
-    includePermissions: z2.boolean().optional(),
-    includeCount: z2.boolean().optional(),
-    includeExtraHeaders: z2.boolean().optional(),
-    populateAccess: z2.unknown().optional()
+  skip: z3.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  limit: z3.union([positiveIntegerSchema, positiveIntegerString]).optional(),
+  page: z3.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  pageSize: z3.union([positiveIntegerSchema, positiveIntegerString]).optional(),
+  options: z3.object({
+    skim: z3.boolean().optional(),
+    includePermissions: z3.boolean().optional(),
+    includeCount: z3.boolean().optional(),
+    includeExtraHeaders: z3.boolean().optional(),
+    populateAccess: z3.unknown().optional()
   }).passthrough().optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query"]));
-var countBodySchema = z2.object({
-  filter: objectOrArraySchema.optional(),
-  options: z2.object({
-    access: z2.unknown().optional()
-  }).passthrough().optional()
-}).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query", "access"]));
-var readFilterBodySchema = z2.object({
+var countBodySchema = z3.object({
+  filter: objectOrArraySchema.optional()
+}).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query", "access", "options"]));
+var readFilterBodySchema = z3.object({
   filter: objectOrArraySchema.optional(),
   select: projectionSchema.optional(),
   sort: sortSchema.optional(),
   populate: populateSchema.optional(),
   include: includeSchema.optional(),
   tasks: tasksSchema.optional(),
-  options: z2.object({
-    skim: z2.boolean().optional(),
-    includePermissions: z2.boolean().optional(),
-    tryList: z2.boolean().optional(),
-    populateAccess: z2.unknown().optional()
+  options: z3.object({
+    skim: z3.boolean().optional(),
+    includePermissions: z3.boolean().optional(),
+    tryList: z3.boolean().optional(),
+    populateAccess: z3.unknown().optional()
   }).passthrough().optional()
 }).passthrough();
-var readByIdBodySchema = z2.object({
+var readByIdBodySchema = z3.object({
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   include: includeSchema.optional(),
   tasks: tasksSchema.optional(),
-  options: z2.object({
-    skim: z2.boolean().optional(),
-    includePermissions: z2.boolean().optional(),
-    tryList: z2.boolean().optional(),
-    populateAccess: z2.unknown().optional()
+  options: z3.object({
+    skim: z3.boolean().optional(),
+    includePermissions: z3.boolean().optional(),
+    tryList: z3.boolean().optional(),
+    populateAccess: z3.unknown().optional()
   }).passthrough().optional()
 }).passthrough();
-var advancedCreateBodySchema = z2.object({
-  data: z2.unknown(),
+var advancedCreateBodySchema = z3.object({
+  data: z3.unknown(),
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   tasks: tasksSchema.optional(),
-  options: z2.object({
-    includePermissions: z2.boolean().optional(),
-    populateAccess: z2.unknown().optional()
+  options: z3.object({
+    includePermissions: z3.boolean().optional(),
+    populateAccess: z3.unknown().optional()
   }).passthrough().optional()
 }).passthrough();
-var createBodySchema = z2.union([
-  z2.record(z2.string(), z2.unknown()),
-  z2.array(z2.record(z2.string(), z2.unknown()))
+var createBodySchema = z3.union([
+  z3.record(z3.string(), z3.unknown()),
+  z3.array(z3.record(z3.string(), z3.unknown()))
 ]);
-var updateBodySchema = z2.record(z2.string(), z2.unknown());
-var advancedUpdateBodySchema = z2.object({
-  data: z2.unknown(),
+var updateBodySchema = z3.record(z3.string(), z3.unknown());
+var advancedUpdateBodySchema = z3.object({
+  data: z3.unknown(),
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   tasks: tasksSchema.optional(),
-  options: z2.object({
-    returningAll: z2.boolean().optional(),
-    includePermissions: z2.boolean().optional(),
-    populateAccess: z2.unknown().optional()
+  options: z3.object({
+    returningAll: z3.boolean().optional(),
+    includePermissions: z3.boolean().optional(),
+    populateAccess: z3.unknown().optional()
   }).passthrough().optional()
 }).passthrough();
-var upsertBodySchema = z2.record(z2.string(), z2.unknown());
-var advancedUpsertBodySchema = z2.object({
-  data: z2.record(z2.string(), z2.unknown()),
+var upsertBodySchema = z3.record(z3.string(), z3.unknown());
+var advancedUpsertBodySchema = z3.object({
+  data: z3.record(z3.string(), z3.unknown()),
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   tasks: tasksSchema.optional(),
-  options: z2.object({
-    returningAll: z2.boolean().optional(),
-    includePermissions: z2.boolean().optional(),
-    populateAccess: z2.unknown().optional()
+  options: z3.object({
+    returningAll: z3.boolean().optional(),
+    includePermissions: z3.boolean().optional(),
+    populateAccess: z3.unknown().optional()
   }).passthrough().optional()
 }).passthrough();
-var distinctBodySchema = z2.object({
+var distinctBodySchema = z3.object({
   filter: objectOrArraySchema.optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query"]));
-var subListBodySchema = z2.object({
-  filter: z2.record(z2.string(), z2.unknown()).optional(),
+var subListBodySchema = z3.object({
+  filter: z3.record(z3.string(), z3.unknown()).optional(),
   select: fieldsSchema.optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["fields"]));
-var subMutationBodySchema = z2.union([
-  z2.record(z2.string(), z2.unknown()),
-  z2.array(z2.record(z2.string(), z2.unknown()))
+var subMutationBodySchema = z3.union([
+  z3.record(z3.string(), z3.unknown()),
+  z3.array(z3.record(z3.string(), z3.unknown()))
 ]);
-var subReadBodySchema = z2.object({
+var subReadBodySchema = z3.object({
   select: fieldsSchema.optional(),
   populate: subPopulateSchema.optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["fields"]));
@@ -637,54 +1535,54 @@ var requestSchemas = {
 };
 
 // src/validation/data-router.ts
-import { z as z3 } from "zod";
-var dataListBodySchema = z3.object({
+import { z as z4 } from "zod";
+var dataListBodySchema = z4.object({
   filter: objectOrArraySchema.optional(),
   select: projectionSchema.optional(),
-  sort: z3.string().optional(),
-  skip: z3.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  limit: z3.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  page: z3.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  pageSize: z3.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  options: z3.object({
-    includeCount: z3.boolean().optional(),
-    includeExtraHeaders: z3.boolean().optional()
+  sort: z4.string().optional(),
+  skip: z4.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  limit: z4.union([positiveIntegerSchema, positiveIntegerString]).optional(),
+  page: z4.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  pageSize: z4.union([positiveIntegerSchema, positiveIntegerString]).optional(),
+  options: z4.object({
+    includeCount: z4.boolean().optional(),
+    includeExtraHeaders: z4.boolean().optional()
   }).passthrough().optional()
 }).passthrough();
-var dataReadFilterBodySchema = z3.object({
+var dataReadFilterBodySchema = z4.object({
   filter: objectOrArraySchema.optional(),
   select: projectionSchema.optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["options"]));
-var dataReadByIdBodySchema = z3.object({
+var dataReadByIdBodySchema = z4.object({
   select: projectionSchema.optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["options"]));
 
 // src/validation/root-router.ts
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 var rootEntryBaseSchema = {
-  target: z4.enum(["model", "data"]),
-  name: z4.string().min(1),
-  order: z4.number().int().optional()
+  target: z5.enum(["model", "data"]),
+  name: z5.string().min(1),
+  order: nonNegativeIntegerSchema.optional()
 };
-var rootModelListArgsSchema = z4.object({
+var rootModelListArgsSchema = z5.object({
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   include: includeSchema.optional(),
   sort: sortSchema.optional(),
-  skip: z4.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  limit: z4.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  page: z4.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  pageSize: z4.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  skip: z5.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  limit: z5.union([positiveIntegerSchema, positiveIntegerString]).optional(),
+  page: z5.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  pageSize: z5.union([positiveIntegerSchema, positiveIntegerString]).optional(),
   tasks: tasksSchema.optional()
 }).passthrough();
-var rootModelListOptionsSchema = z4.object({
-  skim: z4.boolean().optional(),
-  includePermissions: z4.boolean().optional(),
-  includeCount: z4.boolean().optional(),
-  populateAccess: z4.unknown().optional(),
-  lean: z4.boolean().optional()
+var rootModelListOptionsSchema = z5.object({
+  skim: z5.boolean().optional(),
+  includePermissions: z5.boolean().optional(),
+  includeCount: z5.boolean().optional(),
+  populateAccess: z5.unknown().optional(),
+  lean: z5.boolean().optional()
 }).passthrough();
-var rootModelReadArgsSchema = z4.object({
+var rootModelReadArgsSchema = z5.object({
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   include: includeSchema.optional(),
@@ -693,203 +1591,214 @@ var rootModelReadArgsSchema = z4.object({
 var rootModelReadFilterArgsSchema = rootModelReadArgsSchema.extend({
   sort: sortSchema.optional()
 });
-var rootModelReadOptionsSchema = z4.object({
-  skim: z4.boolean().optional(),
-  includePermissions: z4.boolean().optional(),
-  tryList: z4.boolean().optional(),
-  populateAccess: z4.unknown().optional(),
-  lean: z4.boolean().optional()
+var rootModelReadOptionsSchema = z5.object({
+  skim: z5.boolean().optional(),
+  includePermissions: z5.boolean().optional(),
+  tryList: z5.boolean().optional(),
+  populateAccess: z5.unknown().optional(),
+  lean: z5.boolean().optional()
 }).passthrough();
-var rootModelCreateArgsSchema = z4.object({
+var rootModelCreateArgsSchema = z5.object({
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   tasks: tasksSchema.optional()
 }).passthrough();
-var rootModelCreateOptionsSchema = z4.object({
-  skim: z4.boolean().optional(),
-  includePermissions: z4.boolean().optional(),
-  populateAccess: z4.unknown().optional()
+var rootModelCreateOptionsSchema = z5.object({
+  skim: z5.boolean().optional(),
+  includePermissions: z5.boolean().optional(),
+  populateAccess: z5.unknown().optional()
 }).passthrough();
-var rootModelUpdateArgsSchema = z4.object({
+var rootModelUpdateArgsSchema = z5.object({
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   tasks: tasksSchema.optional()
 }).passthrough();
-var rootModelUpdateOptionsSchema = z4.object({
-  skim: z4.boolean().optional(),
-  returningAll: z4.boolean().optional(),
-  includePermissions: z4.boolean().optional(),
-  populateAccess: z4.unknown().optional()
+var rootModelUpdateOptionsSchema = z5.object({
+  skim: z5.boolean().optional(),
+  returningAll: z5.boolean().optional(),
+  includePermissions: z5.boolean().optional(),
+  populateAccess: z5.unknown().optional()
 }).passthrough();
 var rootModelUpsertArgsSchema = rootModelUpdateArgsSchema;
 var rootModelUpsertOptionsSchema = rootModelUpdateOptionsSchema;
-var rootModelSubListArgsSchema = z4.object({
+var rootModelSubListArgsSchema = z5.object({
   select: fieldsSchema.optional()
 }).passthrough();
-var rootModelSubReadArgsSchema = z4.object({
+var rootModelSubReadArgsSchema = z5.object({
   select: fieldsSchema.optional(),
   populate: subPopulateSchema.optional()
 }).passthrough();
-var rootModelCountOptionsSchema = z4.object({
-  access: z4.unknown().optional()
-}).passthrough();
-var rootDataListArgsSchema = z4.object({
+var rootModelCountOptionsSchema = z5.object({}).strict().optional();
+var rootDataListArgsSchema = z5.object({
   select: projectionSchema.optional(),
-  sort: z4.string().optional(),
-  skip: z4.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  limit: z4.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  page: z4.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  pageSize: z4.union([nonNegativeIntegerSchema, positiveIntegerString]).optional()
+  sort: z5.string().optional(),
+  skip: z5.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  limit: z5.union([positiveIntegerSchema, positiveIntegerString]).optional(),
+  page: z5.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  pageSize: z5.union([positiveIntegerSchema, positiveIntegerString]).optional()
 }).passthrough();
-var rootDataListOptionsSchema = z4.object({
-  includeCount: z4.boolean().optional()
+var rootDataListOptionsSchema = z5.object({
+  includeCount: z5.boolean().optional()
 }).passthrough();
-var rootDataReadArgsSchema = z4.object({
+var rootDataReadArgsSchema = z5.object({
   select: projectionSchema.optional()
 }).passthrough();
-var rootModelQueryEntrySchema = z4.union([
-  z4.object({ ...rootEntryBaseSchema, target: z4.literal("model"), op: z4.literal("new") }).passthrough(),
-  z4.object({
+var rootModelNewArgsSchema = z5.object({
+  select: projectionSchema.optional()
+}).passthrough();
+var rootModelNewOptionsSchema = z5.object({
+  skim: z5.boolean().optional(),
+  includePermissions: z5.boolean().optional()
+}).passthrough();
+var rootModelQueryEntrySchema = z5.union([
+  z5.object({
     ...rootEntryBaseSchema,
-    target: z4.literal("model"),
-    op: z4.literal("list"),
+    target: z5.literal("model"),
+    op: z5.literal("new"),
+    args: rootModelNewArgsSchema.optional(),
+    options: rootModelNewOptionsSchema.optional()
+  }).passthrough(),
+  z5.object({
+    ...rootEntryBaseSchema,
+    target: z5.literal("model"),
+    op: z5.literal("list"),
     filter: objectOrArraySchema.optional(),
     args: rootModelListArgsSchema.optional(),
     options: rootModelListOptionsSchema.optional()
   }).passthrough(),
-  z4.object({
+  z5.object({
     ...rootEntryBaseSchema,
-    target: z4.literal("model"),
-    op: z4.literal("read"),
-    id: z4.string().min(1),
+    target: z5.literal("model"),
+    op: z5.literal("read"),
+    id: z5.string().min(1),
     args: rootModelReadArgsSchema.optional(),
     options: rootModelReadOptionsSchema.optional()
   }).passthrough(),
-  z4.object({
+  z5.object({
     ...rootEntryBaseSchema,
-    target: z4.literal("model"),
-    op: z4.literal("read"),
+    target: z5.literal("model"),
+    op: z5.literal("read"),
     filter: objectOrArraySchema,
     args: rootModelReadFilterArgsSchema.optional(),
     options: rootModelReadOptionsSchema.optional()
   }).passthrough(),
-  z4.object({
+  z5.object({
     ...rootEntryBaseSchema,
-    target: z4.literal("model"),
-    op: z4.literal("create"),
-    data: z4.unknown(),
+    target: z5.literal("model"),
+    op: z5.literal("create"),
+    data: z5.unknown(),
     args: rootModelCreateArgsSchema.optional(),
     options: rootModelCreateOptionsSchema.optional()
   }).passthrough(),
-  z4.object({
+  z5.object({
     ...rootEntryBaseSchema,
-    target: z4.literal("model"),
-    op: z4.literal("update"),
-    id: z4.string().min(1),
-    data: z4.unknown(),
+    target: z5.literal("model"),
+    op: z5.literal("update"),
+    id: z5.string().min(1),
+    data: z5.unknown(),
     args: rootModelUpdateArgsSchema.optional(),
     options: rootModelUpdateOptionsSchema.optional()
   }).passthrough(),
-  z4.object({
+  z5.object({
     ...rootEntryBaseSchema,
-    target: z4.literal("model"),
-    op: z4.literal("upsert"),
-    data: z4.record(z4.string(), z4.unknown()),
+    target: z5.literal("model"),
+    op: z5.literal("upsert"),
+    data: z5.record(z5.string(), z5.unknown()),
     args: rootModelUpsertArgsSchema.optional(),
     options: rootModelUpsertOptionsSchema.optional()
   }).passthrough(),
-  z4.object({ ...rootEntryBaseSchema, target: z4.literal("model"), op: z4.literal("delete"), id: z4.string().min(1) }).passthrough(),
-  z4.object({
+  z5.object({ ...rootEntryBaseSchema, target: z5.literal("model"), op: z5.literal("delete"), id: z5.string().min(1) }).passthrough(),
+  z5.object({
     ...rootEntryBaseSchema,
-    target: z4.literal("model"),
-    op: z4.literal("subList"),
-    id: z4.string().min(1),
-    sub: z4.string().min(1),
-    filter: z4.record(z4.string(), z4.unknown()).optional(),
+    target: z5.literal("model"),
+    op: z5.literal("subList"),
+    id: z5.string().min(1),
+    sub: z5.string().min(1),
+    filter: z5.record(z5.string(), z5.unknown()).optional(),
     args: rootModelSubListArgsSchema.optional()
   }).passthrough(),
-  z4.object({
+  z5.object({
     ...rootEntryBaseSchema,
-    target: z4.literal("model"),
-    op: z4.literal("subRead"),
-    id: z4.string().min(1),
-    sub: z4.string().min(1),
-    subId: z4.string().min(1),
+    target: z5.literal("model"),
+    op: z5.literal("subRead"),
+    id: z5.string().min(1),
+    sub: z5.string().min(1),
+    subId: z5.string().min(1),
     args: rootModelSubReadArgsSchema.optional()
   }).passthrough(),
-  z4.object({
+  z5.object({
     ...rootEntryBaseSchema,
-    target: z4.literal("model"),
-    op: z4.literal("subCreate"),
-    id: z4.string().min(1),
-    sub: z4.string().min(1),
-    data: z4.union([z4.record(z4.string(), z4.unknown()), z4.array(z4.record(z4.string(), z4.unknown()))])
+    target: z5.literal("model"),
+    op: z5.literal("subCreate"),
+    id: z5.string().min(1),
+    sub: z5.string().min(1),
+    data: z5.union([z5.record(z5.string(), z5.unknown()), z5.array(z5.record(z5.string(), z5.unknown()))])
   }).passthrough(),
-  z4.object({
+  z5.object({
     ...rootEntryBaseSchema,
-    target: z4.literal("model"),
-    op: z4.literal("subUpdate"),
-    id: z4.string().min(1),
-    sub: z4.string().min(1),
-    subId: z4.string().min(1),
-    data: z4.union([z4.record(z4.string(), z4.unknown()), z4.array(z4.record(z4.string(), z4.unknown()))])
+    target: z5.literal("model"),
+    op: z5.literal("subUpdate"),
+    id: z5.string().min(1),
+    sub: z5.string().min(1),
+    subId: z5.string().min(1),
+    data: z5.union([z5.record(z5.string(), z5.unknown()), z5.array(z5.record(z5.string(), z5.unknown()))])
   }).passthrough(),
-  z4.object({
+  z5.object({
     ...rootEntryBaseSchema,
-    target: z4.literal("model"),
-    op: z4.literal("subBulkUpdate"),
-    id: z4.string().min(1),
-    sub: z4.string().min(1),
-    data: z4.union([z4.record(z4.string(), z4.unknown()), z4.array(z4.record(z4.string(), z4.unknown()))])
+    target: z5.literal("model"),
+    op: z5.literal("subBulkUpdate"),
+    id: z5.string().min(1),
+    sub: z5.string().min(1),
+    data: z5.union([z5.record(z5.string(), z5.unknown()), z5.array(z5.record(z5.string(), z5.unknown()))])
   }).passthrough(),
-  z4.object({
+  z5.object({
     ...rootEntryBaseSchema,
-    target: z4.literal("model"),
-    op: z4.literal("subDelete"),
-    id: z4.string().min(1),
-    sub: z4.string().min(1),
-    subId: z4.string().min(1)
+    target: z5.literal("model"),
+    op: z5.literal("subDelete"),
+    id: z5.string().min(1),
+    sub: z5.string().min(1),
+    subId: z5.string().min(1)
   }).passthrough(),
-  z4.object({
+  z5.object({
     ...rootEntryBaseSchema,
-    target: z4.literal("model"),
-    op: z4.literal("distinct"),
-    field: z4.string().min(1),
+    target: z5.literal("model"),
+    op: z5.literal("distinct"),
+    field: z5.string().min(1),
     filter: objectOrArraySchema.optional()
   }).passthrough(),
-  z4.object({
+  z5.object({
     ...rootEntryBaseSchema,
-    target: z4.literal("model"),
-    op: z4.literal("count"),
+    target: z5.literal("model"),
+    op: z5.literal("count"),
     filter: objectOrArraySchema.optional(),
     options: rootModelCountOptionsSchema.optional()
-  }).passthrough()
+  }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["access"]))
 ]);
-var rootDataQueryEntrySchema = z4.union([
-  z4.object({
+var rootDataQueryEntrySchema = z5.union([
+  z5.object({
     ...rootEntryBaseSchema,
-    target: z4.literal("data"),
-    op: z4.literal("list"),
+    target: z5.literal("data"),
+    op: z5.literal("list"),
     filter: objectOrArraySchema.optional(),
     args: rootDataListArgsSchema.optional(),
     options: rootDataListOptionsSchema.optional()
   }).passthrough(),
-  z4.object({
+  z5.object({
     ...rootEntryBaseSchema,
-    target: z4.literal("data"),
-    op: z4.literal("read"),
-    id: z4.string().min(1),
+    target: z5.literal("data"),
+    op: z5.literal("read"),
+    id: z5.string().min(1),
     args: rootDataReadArgsSchema.optional()
   }).passthrough(),
-  z4.object({
+  z5.object({
     ...rootEntryBaseSchema,
-    target: z4.literal("data"),
-    op: z4.literal("read"),
+    target: z5.literal("data"),
+    op: z5.literal("read"),
     filter: objectOrArraySchema,
     args: rootDataReadArgsSchema.optional()
   }).passthrough()
 ]);
-var rootQuerySchema = z4.array(z4.union([rootModelQueryEntrySchema, rootDataQueryEntrySchema]));
+var rootQuerySchema = z5.array(z5.union([rootModelQueryEntrySchema, rootDataQueryEntrySchema]));
 export {
   Codes,
   CustomHeaders,